fix(ddp-streamer): use graceful ws.close() on user.forceLogout

The microservices ddp-streamer was using ws.terminate() (TCP RST) for
broadcast force-logouts. The monolith path uses session.connectionHandle.close()
which is graceful and flushes the WS buffer first — letting the
`notify-user/<uid>/force_logout` stream message (queued by
apps/meteor/server/modules/listeners/listeners.module.ts:49) reach the
client before the socket goes down.

In EE that stream message races with the terminate, terminate wins, the
client's useForceLogout hook never fires, and tests like
e2e-encryption/e2ee-passphrase-management.spec.ts:87 are left with
stale localStorage credentials and a Login button that never hides.

Switch to ws.close() with a 5s setTimeout fallback to terminate() for
unresponsive sockets — matches the graceful-close semantics the
monolith already relies on without losing the safety net for zombies.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ggazzo

ee/apps/ddp-streamer/src/DDPStreamer.ts

@@ -60,7 +60,23 @@ export class DDPStreamer extends ServiceClass {
 					return;
 				}
 				if (client?.userId === uid) {
-					ws.terminate();
+					// Graceful close: lets the WS lib flush queued frames (including
+					// the `notify-user/<uid>/force_logout` stream message that the
+					// monolith listener at apps/meteor/server/modules/listeners/listeners.module.ts:49
+					// just enqueued) before the socket goes down. Previously this was
+					// `ws.terminate()`, which sends a TCP RST immediately and drops
+					// the queued frames — clients depending on the stream message
+					// (useForceLogout hook → Accounts._unstoreLoginToken + setUserId(null))
+					// then never see the cleanup, leaving stale credentials in
+					// localStorage. Falls back to terminate() after a short grace
+					// period for unresponsive sockets.
+					ws.close();
+					const guard = setTimeout(() => {
+						if (ws.readyState !== ws.CLOSED) {
+							ws.terminate();
+						}
+					}, 5000);
+					ws.once('close', () => clearTimeout(guard));
 				}
 			});
 		});